5
Functional Safety to IEC 61508
The LC3050 is certified to IEC 61508 if used in conjunction with the LP30 Low
Level Probe. This standard describes the Functional Safety of safety-related
electrical /electronic / programmable electronic systems. The Safety Function of
the LC3050 corresponds to a Safety Integrity (SIL) 2 when used in a 1oo1 architecture
and SIL 3 when used in a 1oo2 architecture.
In most countries two independent low water limiting systems must be installed
on steam boilers.
Level probes must be installed in separate protection tubes / chambers, with
sufficient clearance between the tips and earth.
Each probe must be connected to an independent controller. The alarm relays must
isolate the boiler heat supply at low alarm status.
A high water alarm may be part of the water level control, or a separate system. An
independent high water alarm system must be fitted if it is considered a safety
requirement.
In this case, the relays must simultaneously isolate the feedwater supply and the
boiler heat supply at high alarm status. All boiler water limiters require regular
functional testing.
The level probe and controller is only part of the safety system. To complete the
system, additional circuitry (wiring, relays, alarm bell / lamp etc.) is required.
A suitable water treatment regime must be used to ensure continuous safe and
correct operation of the control and limiter systems. Consult the above authorities
and a competent water treatment company.
Failed product
In the unlikely event of a fault condition to trigger the alarm with the LC3050 / LP30
low level system the standard Maintenance and Fault finding procedures listed in
this instruction manual must be followed - Please refer to Section 9.
In the event the condition cannot be resolved, the standard device repair and return
procedures listed in Section 10.2 of this manual must be followed.
The end user shall retain failed components and return them to Spirax-Sarco
Limited along with details of failure mode and time in service (operational).
This will allow the 'actual' failure rates to be calculated and compared with those
estimated in the Failure, Modes, Effects Diagnostics Analysis (FMEDA). A FMEDA is
one of the steps to be taken to achieve functional safety certification per IEC 61508
of a device. From the FMEDA, failure rates are determined and consequently the Safe
Failure Fraction (SFF) is calculated for the device. For full safety certification
purposes all requirements of IEC 61508 will be considered.
Leading to product improvement and hence maintaining /reassuring its SIL rating.
We wish to encourage end-users to collect failure rate data and to provide feedback
on design integrity.
